edit-spec
Pass
Audited by Gen Agent Trust Hub on Aug 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
npxto execute commands such asnpx vigiles compile,npx vigiles lint, andnpx vigiles initto generate artifacts and validate project configuration. - [EXTERNAL_DOWNLOADS]: The skill utilizes
npx, which downloads packages from the npm registry if not present locally. It also references an external plugin via the/plugin installcommand for thevigilestoolset. - [PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface by using user-supplied
$ARGUMENTSto direct the modification of executable TypeScript specification files. - Ingestion points: User input provided via the
$ARGUMENTSparameter inSKILL.mdis used to guide file edits in.spec.tsfiles. - Boundary markers: No explicit delimiters or instructions to ignore embedded commands are used when incorporating user input into the editing process.
- Capability inventory: The skill has the ability to read and write files (specifically
.spec.tsfiles) and execute shell commands vianpx. - Sanitization: The skill does not implement specific sanitization or validation logic for the user-supplied strings before they are used to modify the project's specification code.
Audit Metadata